🔍 Read the full analysis: What Links Record CVEs, A $6 Billion Heist And AI In Black October? on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
October 2026 saw 17,060 new CVE records published, 36 additions to CISA’s Known Exploited Vulnerabilities catalog, and reported crypto losses of $3.47 billion after returned or frozen funds were excluded. The source attributes the largest theft, from Binance, to North Korea, while citing AI-assisted vulnerability research and warning that the data does not show disclosure growth translating directly into exploitation.
October 2026 set records for newly published vulnerability records and reported cryptocurrency losses, but known exploitation rose far less sharply than disclosures, according to data compiled by Thorsten Meyer. The month’s largest reported theft was the October 29 Binance incident, which the FBI attributed to North Korea’s TraderTraitor group on October 31; Meyer says the breach began with a compromised laptop, not an AI-found software flaw.
Meyer’s count of the U.S. National Vulnerability Database (NVD) records shows 17,060 new CVEs in October, excluding rejected records, compared with 4,273 in October 2025. For January through October, the count was 89,859, against 39,639 in the same period a year earlier. The figures are based on a query of the NVD API on November 1 and count records by publication date. Including rejected records would put October’s total at 17,481, Meyer said.
A separate measure of confirmed exploitation rose more modestly. The Cybersecurity and Infrastructure Security Agency added 36 vulnerabilities to its Known Exploited Vulnerabilities catalog in October, compared with 31 in October 2025 and 17 in October 2024. The catalog’s October 30 version showed 282 additions for 2026 to date, already above the 245 added in all of 2025. Five of October’s entries were older flaws, from 2015 to 2023, for which new exploitation evidence had emerged.
CertiK’s accounting, as cited by Meyer, put October cryptocurrency losses at $3.47 billion after frozen and returned funds were removed, compared with $68 million in October 2025. Meyer says the Binance theft accounted for 96.7% of the October total. The article does not provide an independently verified breakdown of the stolen assets or the full calculation behind that share.
Infographic 01 · Three ledgers
Black October: three records, very different sizes
Disclosed flaws quadrupled. Exploited flaws rose, but far less. Crypto losses jumped because of one theft.
New CVE records
October 2026 · 4× October 2025
Added to CISA’s KEV list
October 2026 · known exploited flaws
Crypto losses after freezes
October 2026 · CertiK, adjusted
CVE: records by publication date, rejected records excluded. KEV: additions by date added. Crypto: CertiK “adjusted” = losses minus frozen or returned funds; other counters (Chainalysis, PeckShield) use different methods. Years compared January to October, because 2026 is not over.
Sources: NVD CVE API 2.0 (author query, 1 Nov 2026), CISA KEV catalog, version 2026.10.30, GTIG, 30 Sep 2026, CertiK Hack3D dashboard (adjusted losses), FBI, 31 Oct 2026, Microsoft October 2026 update file. Counts by Thorsten Meyer.
Powered by Thorsten Meyer AI
Disclosure Outpaced Confirmed Exploitation
The figures track different things: CVE records count publicly documented vulnerabilities, CISA’s catalog records flaws for which there is reliable evidence of active exploitation, and crypto-loss estimates track reported thefts. They should not be treated as interchangeable measures of risk. The sharp gap between disclosure and catalog additions means the CVE surge alone does not establish a matching surge in attacks.
That distinction matters to organizations deciding what to patch first. A growing CVE list can overwhelm security teams, while a catalog entry signals documented attacker use and can help prioritize remediation. Meyer cites Google Threat Intelligence Group figures saying that only about one in 431 vulnerabilities disclosed in 2026 had been observed exploited. That estimate is attributed to the group and depends on what it could observe; it is not proof that the other vulnerabilities are harmless.
The Binance theft also complicates claims that AI is driving every major security incident. Meyer’s account connects AI to vulnerability discovery and faster exploit development, but says the theft began with a compromised laptop. The episode therefore offers evidence of AI’s expanding role in security work, not evidence that AI caused the month’s biggest reported loss.
Products Worth Considering
Dell 34-Inch S3425DW Curved WQHD USB-C Monitor
Logitech MX Brio Ultra HD 4K Webcam, Graphite
Dell UltraSharp 27 Thunderbolt Hub Monitor (U2726DER)
As an affiliate, we earn on qualifying purchases.
Three Measures, Different Signals
Meyer frames October as three separate “ledgers”: disclosed flaws, observed exploitation, and stolen cryptocurrency. NVD publication totals depend on how records are counted and who assigns them. Meyer notes that automated assignment policies can raise totals; Google Threat Intelligence Group said descriptions mentioning the Linux kernel alone generated about 5,000 CVEs from January to August 2026, with no observed zero-day exploitation in that set.
For exploitation, Meyer cites Google’s September 30 review of January-to-August activity: it counted 141 distinct vulnerabilities disclosed and exploited, more than the 127 counted for all of 2025. The source also reports a rise in average monthly exploitation, from 10.5 in 2025 to 18 in 2026 during the period it examined. These figures indicate growth in observed exploitation, but not at the same rate as the NVD disclosure totals.
The source also identifies AI-linked work in Microsoft’s October security release, saying at least 65 entries credited an AI model or an AI vulnerability research firm, including a flaw already exploited in the wild. It says PHP2Shell, patched October 21, came from OpenAI’s Patch the Planet program, and that Google’s Big Sleep found more actionable Chrome JavaScript-engine bugs than Google’s own fuzzer over six months. Those examples document research and fixes; they do not by themselves establish how much AI changed the overall number of attacks.
“October was episode one: the first month in which AI found serious flaws at scale in the software we all run, and the fixes shipped in the same month.”
— Thorsten Meyer, in the November 1 report
What the October Counts Cannot Show
The source is a dated analysis, not a complete official accounting of every October incident. NVD totals can change with publication practices and counting rules, and the gap between published flaws and KEV entries does not show that no unlisted flaw was exploited. The available material also does not establish a causal link between AI tools and the record number of CVEs or the month’s total losses.
Details of the Binance incident remain limited in the supplied account. It says the FBI attributed the theft to North Korea’s TraderTraitor group and describes a compromised laptop as the starting point, but does not provide the FBI’s underlying evidence, the exact attack sequence, or a full account of recovery efforts. The reported $3.47 billion figure is attributed to CertiK and excludes funds frozen or returned; the source does not explain every component of its calculation.
Meyer argues that attackers can use AI to turn fixes into exploits within days and says an embargo on PHP2Shell broke before release. The supplied material does not quantify how often this occurred across October, establish that AI was used in each case, or detail the incidents behind the claim. His prediction of more attacks and public disclosures aided by large language models is explicitly his view, not a measured forecast.
Patch Priorities and Further Evidence
Security teams will need to track updates to CISA’s KEV catalog and prioritize vulnerabilities that have evidence of active exploitation, alongside flaws affecting internet-facing systems. The October data shows why simply ranking work by the volume of CVE publications may be inadequate: the disclosure pool grew much faster than the list of newly cataloged exploited flaws.
Further reporting would be needed to verify the Binance incident’s attack path, the amount ultimately recovered, and the evidence behind the FBI attribution. Later data can also show whether October’s disclosure and loss records were sustained or were driven by a small number of unusually large contributions. For the AI claims, the next useful evidence would be documented timelines connecting AI-assisted discovery, public disclosure, patch availability, and real-world exploitation.
Key Questions
What records did October 2026 set?
Thorsten Meyer counted 17,060 new NVD CVE records for October, excluding rejected records, and cited CertiK’s estimate of $3.47 billion in crypto losses after frozen and returned funds were excluded. These are separate measures and do not describe the same type of security event.
Did exploitation rise as fast as vulnerability disclosures?
No, according to the figures in Meyer’s report. CISA added 36 flaws to its Known Exploited Vulnerabilities catalog in October 2026, up from 31 a year earlier, while the NVD’s October publication count was about four times the October 2025 total.
Who was blamed for the Binance theft?
The FBI attributed the theft to North Korea’s TraderTraitor group on October 31, according to Meyer’s report. The supplied account does not include the FBI’s supporting evidence or a detailed description of the attack.
Does the report show that AI caused the October records?
No. It cites AI-linked vulnerability research and argues that AI can help attackers develop exploits quickly, but does not establish that AI caused the overall rise in CVE publications or crypto losses. Meyer says the Binance theft began with a compromised laptop rather than an AI-found flaw.
Source: ThorstenMeyerAI.com
